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LISTING OF THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

I . (Currently Amended) A method for validating credentials comprising: 

inputting, at a first system-a pparatus that grants session credentials based on 
successful authentication, a request from a client to access a protected resource on the first 
system apparatus , the protected resource on the first system- apparatus being accessible by the 
client only after successful authentication of the client at the first syst e m apparatus ; 

determining, at the first s ystem apparatus that a client does not have a valid 
session credential granted by the first system apparatus ; 

after the determining, retrieving, at the first system apparatus , information from a 
session token held by the client, the information being retrieved from the client, the information 
corresponding to a session credential for tbe~a_second s y s t e m apparatus , the second syst e m 
apparatus (1) grants session credentials based on successful authentication at the second 
system apparatus , and (2) includes a protected resource on the second s y s t e m apparatus that is 
accessible by the client; the protected resource on the second sy s tem apparatus being accessible 
by the client only after successful authentication of the client at the second systemapparatus; 

the first system -apparatus p resenting at least some of the information from the 
session token to the second sy st ema pparatus ; 

the first system -apparatus inputting a determination from the second system 
apparatus that the client has a valid session credential with the second system apparatus ; 

the first system- apparatus effecting successful authentication to the client so as to 
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grant access, to the protected resource on the first system apparatus , to the client based on the 
determination from the second system -apparatus that the client has a valid session credential 
with the second system -apparatus ; and 

directing the client to the first system apparatus to establish a session credential 
based on successful authentication at the first system apparatus , after determining that the client 
does not have a valid session credential granted by the second system apparatus . 

2. (Currently Amended) A method according to claim 1, further comprising 
granting a session credential to the client by the first system apparatus , after determining that the 
client has a valid session credential granted by the second syste m apparatus . 

3. (Currently Amended) A method according to claim 1, further comprising sending 
a session token to the client, the token corresponding to a session credential granted by the first 
system apparatus . 

4. (Currently Amended) A method according to claim 1, further comprising 
directing the client to the second syst e m apparatus to establish a session credential based on 
successful authentication at the second syst e m apparatus , after determining that the client does 
not have a valid session credential granted by the second syste mapparatus . 

5. (Canceled). 

6. (Currently Amended) A method according to claim 1 , further comprising 
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maintaining the client session credential granted by the second system apparatus. 

7. (Canceled) 

8. (Currently Amended) A method according to claim 1, wherein retrieving 
information from the session token held by the client comprises: 

sending a query to the client from the first system- apparatus , the query including 
identification as originating from a domain name corresponding to the second syst e m apparatus : 
and 

receiving a response to the query. 

9. (Currently Amended) A method for validating session credentials of a client 
comprising: 

inputting, at a first system- apparatus that grants session credentials based on 
successful authentication, a request from a client to access a protected resource on the first 
system apparatus , the protected resource on the first system -apparatus being accessible by the 
client only after successful authentication of the client at the first system apparatus : 

determining, at the first system -apparatus that a client does not have a valid 
session credential granted by the first sy s t e m apparatus : 

after the determining, retrieving, at the first syste mapparatus , information from a 

session token held by the client, the information being retrieved from the client, the information 

corresponding to a session credential for the-asecond system -apparatus that grants session 

credentials based on successful authentication at the second syst e m apparatus , and the second 
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system- apparatus including a protected resource that is accessible by the client, the retrieving 
information from the session token held by the client comprises receiving a session token from 
the client corresponding to the second syste mapparatus . and the protected resource on the 
second system- apparatus being accessible by the client only after successful authentication of 
the client at the second syst e m apparatus ; 

presenting at least some of the information from the session token to the second 
system apparatus ; 

determining whether the client has a valid session credential granted by the 
second systema pparatus , the determining whether the client has a valid session credential 
granted by the second syst e m apparatus is at least partially from presenting information from 
the session token; 

the first system -apparatus inputting a determination from the second system 
apparatus that the client has a valid session credential with the second syst e m apparatus : 

granting a session credential to the client on the first system apparatus , after 
determining that the client has a valid session credential granted by the second syste mapparatus ; 

sending a session token to the client, the session token corresponding to the 
session credential granted by the first syste mapparatus , the session token allowing the client 
access to protected resources on the first syste mapparatus . so as to provide successful 
authentication to the client; and 

maintaining the client session credential; and 

the first system- a pparatus inputting information from the second 

system apparatus , and in response, the first system-a pparatus o utputting. to the second 

system a pparatus . a determination that the first system-a pparatus has a valid session credential 
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for the client at the first syste mapparatus , and 

the second system a pparatus effecting successful authentication so as to grant 
access, to the further protected resource on the second systema pparatus , to the client based on 
the determination from the first system -apparatus t hat the client has a valid session credential 
with the first s y s t e m apparatus . 

10. (Currently Amended) Computer executable software code stored on a non- 
transitory computer-readable medium and transmitted as an information signal, the code for 
validating credentials, the code comprising: 

code to input, at a first system -apparatus that grants session credentials based on 
successful authentication, a request from a client to access a protected resource on the first 
system apparatus , the protected resource on the first system -apparatus being accessible by the 
client only after successful authentication of the client at the first system apparatus : 

code to determine, at the first system apparatus , that a client does not have a valid 
session credential granted by the first syst e m apparatus : 

code to retrieve, after the determining that the client does not have a valid session 
credential granted by the first system apparatus , at the first syste mapparatus , information from a 
session token held by the client, the information corresponding to a session credential for tfee-a 
second s y ste m - apparatus that grants session credentials based on successful authentication at 
the second syst e m apparatus . the second system -apparatus including a protected resource that is 
accessible by the client, and the protected resource on the second system apparatus being 
accessible by the client only after successful authentication of the client at the second 
system apparatus ; 
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code to present at least some of the information from the session token to the 
second system apparatus ; and 

code to input, from the second system apparatus to the first sy stem apparatus , a 
determination whether the client has a valid session credential granted by the second 
systemapparatus; and 

code to effect successful authentication so as to grant access to the protected 
resource on the first system apparatus , to the client based on the determination from the second 
system apparatus that the client has a valid session credential with the second system apparatus; 
and 

code to direct the client to the first system apparatus to establish a session 
credential based on successful authentication at the in-.t ^w-emapparatus, after determining that 
the client does not have a valid session credential granted by the second system apparatus . 

1 1 . (Currently Amended) A non-transitory computer readable medium having 
computer executable code stored thereon, the code for validating credentials, the code 
comprising; 

code to input, at a first syst e m apparatus that grants session credentials based on successful 

authentication, a request from a client to access a protected resource on the first 

syst e m apparatus , the protected resource on the first s ystem apparatus being accessible by the 

client only after successful authentication of the client at the first syste mapparatus ; 

code to determine, at the first system a p pa rat u s that the client does not have a 

valid session credential granted by the first syste mapparatus ; 

code to retrieve from the client, at the first system -apparatus and after the 
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determining that the client does not have a valid session credential granted by the first 
system apparatus . information from a session token held by the client, the information 
corresponding to a possible session credential for the-a_second system apparatus that grants 
session credentials based on successful authentication at the second system apparatus and that 
has a protected resource that is accessible by the client, the protected resource on the second 
system -apparatus being accessible by the client only after successful authentication of the client 
at the second syste mapparatus ; 

code to present at least some of the information from the session token to the 
second system apparatus ; and 

code to input, from the second system -apparatus to the first system appara tus, a 
determination whether the client has a valid session credential granted by the second 
syst e m apparatus ; and 

code to effect successful authentication to the client so as to grant access to the 
protected resource on the first syste mapparatus , to the client based on the determination from 
the second sys t e m -apparatus that the client has a valid session credential with the second 
system apparatus . 

12. (Currently Amended) A programmed computer for validating credentials, 
comprising: 

a memory having at least one region for storing computer executable program 

code; and 

a processor for executing the program code stored in the memory, wherein the 
program code comprises: 
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code to input, at a first system that grants session credentials based on successful authentication, 
a request from a client to access a protected resource on the first system, the protected resource 
on the first system being accessible by the client only after successful authentication of the 
client at the first system; 

code to determine, at the first system that the client does not have a valid session 
credential granted by the first system; 

code to retrieve, at the first system and after the determining that the client does 
not have a valid session credential granted by the first system, information from a session token 
held by the client, the information corresponding to a session credential for the~asecond system 
that grants session credentials based on successful authentication at the second system, the 
second system including a protected resource that is accessible by the client, the protected 
resource on the second system being accessible by the client only after successful authentication 
of the client at the second system; 

code to present at least some of the information from the session token to the 
second system; and 

code to input, from the second system to the first system, a determination 
whether the client has a valid session credential granted by the second system and 

code to effect successful authentication so as to grant access to the protected 
resource on the first system, to the client based on the determination from the second system 
that the client has a valid session credential with the second system; 

code to direct the client to the first system to establish a session credential based 

on successful authentication at the first system, after determining that the client does not have a 

valid session credential granted by the second system; 
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code to input into the first system information from the second system, and in 
response, output from the first system, to the second system, a determination that the first 
system has a valid session credential for the client at the first system, and 

code to effect successful authentication with the second system so as to grant 
access, to the further protected resource on the second system, to the client based on the 
determination from the first system that the client has a valid session credential with the first 
system. 

13. (Currently Amended) A method for establishing session credentials comprising: 

inputting, at a first system ap paratus that grants session credentials based on 
successful authentication, a request from a client to access a protected resource on the first 
system apparatus . the protected resource on the first system-ap parat us being accessible by the 
client only after successful authentication of the client at the first system apparatus ; 

determining at the first system -apparatus that the client does not have a valid 
session credential granted by a -the first s ys t e m apparatus ; 

determining that the client does not have a valid session credential granted by a 
second system -apparatus based on successful authentication at the second system apparatus ; 

sending, from the first syst e m apparatus to the client, a log in page; 

receiving, at the first system -apparatus from the client, log in information; 

sending, from the first syst e m apparatus to the second syste mapparatus , the log 
in information; and 

after the determining at the first system -apparatus that the client does not have a 

valid session credential granted by a first system-a pparatus , receiving, at the first system 
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apparatus from the second syste mapparatus , information corresponding to a session credential 
granted by the second s yst e m -a pparatus , the session credential granted by the second system 
apparatus based at least in part on the log in information and successful authentication at the 
second system apparatus . the second syst e m apparatus being one that (1) grants session 
credentials based on successful authentication at the second system apparatus . and (2) includes a 
protected resource on the second system- apparatus that is accessible by the client, the protected 
resource on the second system -apparatus being accessible by the client only after successful 
authentication of the client at the second syst e m apparatus ; and 

the first system -apparatus effecting successful authentication so as to grant 
access, to a protected resource on the first syste mapparatus . to the client based on the 
determination from the second syst e m apparatus that the client has a valid session credential 
with the second syste mapparatus ; 

the first system -apparatus inputting information from the second 
system apparatus . and in response, the first system -apparatus outputting. to the second 
syste mapparatus . a determination that the first system -apparatus has a valid session credential 
for the client at the first system apparatus , and 

the second system -apparatus effecting successful authentication so as to grant 
access, to the further protected resource on the second system apparatus . to the client based on 
the determination from the first system -apparatus that the client has a valid session credential 
with the first syst e m apparatus , 

14. (Currently Amended) A method according to claim 13, further comprising 

granting a session credential for the first systema pparatus . 

11 



U.S. PATENT APPLICATION 10/026,403 
ATTORNEY DOCKET: 72167.000570 



15. (Currently Amended) A method according to claim 13, further comprising 
granting a session credential for the second syst e m apparatus. 

16. (Currently Amended) A method according to claim 13, further comprising 
associating session credentials for the first system -apparatus and the second system apparatus 
with the client. 

17. (Currently Amended) A method for establishing session credentials for a client, 
the method comprising: 

inputting, at a first system -apparatus that grants session credentials based on 
successful authentication, a request from a client to access a protected resource on the first 
syst e m apparatus . the protected resource on the first system-a pparatus being accessible by the 
client only after successful authentication of the client at the first system apparatus ; 

determining that the client does not have a valid session credential granted by the 
first syste mapparatus ; 

after the determining, retrieving, at the first syste m apparatus , information from a 
session token held by the client, the information being retrieved from the client, the information 
corresponding to a session credential for tfee~a_second system appartus; 

inputting information at the first syste mapparatus , from the second 

syste mapparatus , that the client does not have a valid session credential granted by the second 

syste mapparatus , the second system -apparatus i ncluding a protected resource, the protected 

resource on the second system- apparatus being accessible by the client only after successful 
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authentication of the client at the second syste m-apparatus ; 

sending, from the second syst e m apparatus to the client, a log in page: 
receiving, at the second system-a pparatus from the client, log in information; and 
sending, from the second syst e m apparatus to the first systom apparatus , 
information corresponding to a session credential granted by the second systom apparatus . the 
session credential granted by the second system- apparatus based at least in part on the log in 
information and successful authentication at the second system- apparatus ; and 

granting a session credential to the client for the first syst e m apparatus so as to 
provide successful authentication, such that the client is granted access to a protected resource 
on the first sy s tom apparatus ; 

the first system -apparatus inputting information from the second 
system a pparatus , and in response, the first system-a pparatus outputting. to the second 
systemapparatus. a determination that the first system -apparatus has a valid session credential 
for the client at the first syst e m apparatus . and 

the second system -apparatus effecting successful authentication so as to grant 
access, to the further protected resource on the second systom a pparatus , to the client based on 
the determination from the first system- apparatus that the client has a valid session credential 
with the first system apparatus . 

1 8. (Currently Amended) A method according to claim 1 7, further comprising 
granting a session credential for the second syst e m apparatus . 

19. (Currently Amended) A method according to claim 17, further comprising 
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associating session credentials for the first s y s t e m -apparatus and the second system apparatus 
with the client. 

20. (Currently Amended) A method for validating credentials comprising: 

inputting, at a first system app aratus, that grants session credentials based on 
successful authentication, a request from a client to access a protected resource on the first 
system apparatus; 

determining, at the first system apparatus that a client does not have a valid 
session credential granted by the first syst e m apparatus ; 

redirecting the client to the-a_second system apparatus that grants session 
credentials based on successful authentication at the second system apparatus , the second system 
apparatus having a protected resource that is accessible by the client; 

sending, from the second system apparatus to the first syst e m apparatus , session 
credentials granted by the second syste mapparatus ; 

sending, from the first system a pparatus to the second system apparatus , the 
session credentials granted by the second system apparatus ; 

determining, at the second syst e m apparatus , that the session credentials granted 
by the second system apparatus , and received from the first system apparatus, are valid; and 

sending, from the second syst e m apparatus to the first s y s t e mapparatus . 
information indicating that the session credentials granted by the second system apparatus are 
valid; and 

inputting, at the second system apparatus that grants session credentials based on 

successful authentication, a request from a client to access a protected resource on the second 
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system apparatus; 

determining, at the second syst e m apparatus that a client does not have a valid 
session credential granted by the second system-a pparatus ; 

after such determining, retrieving, at the second syst c m apparatus , information 
from a session token held by the client, the information being retrieved from the client, the 
information corresponding to a session credential for the first syst e m apparatus ; 

redirecting the client to the first system- apparatus that grants session credentials 
based on successful authentication at the first systcm apparatus ; 

sending, from the first system apparatus to the second system apparatus . session 
credentials granted by the first s ystem apparatus ; 

sending, from the second syst e m apparatus to the first system apparatus . the 
session credentials granted by the first syste mapparatus ; 

determining, at the first syste mapparatus . that the session credentials granted by 
the first syste mapparatus , and received from the second system apparatus . are valid; and 

sending, from the first system apparatus to the second system apparatus . 
information indicating that the session credentials granted by the first system- apparatus are 
valid. 



21.-22. (Canceled) 



23. (Currently Amended) A method for validating credentials comprising: 

inputting, at a first system -apparatus that grants session credentials based on 

successful authentication, a request from a client to access a protected resource on the first 
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system apparatus . the protected resource being accessible upon successful authentication of the 
client at the first s - yst e mapparatu s ; 

determining, at the first system apparatus that the client does not have a valid 
session credential granted by the first syste m-apparatus , so as to allow the client access to the 
protected resource on the first syste mapparatus ; 

after the determining, retrieving, at the first syste mapparatus . information from a 
session token held by the client, the information being retrieved from the client, the information 
corresponding to a session credential for »e-a_second system -apparatus ; 

the first system communicating with a-the second system apparatus . the second 
system-apparatus having a further protected resource on the second syste mapparatus . the further 
protected resource being accessible upon successful authentication of the client at the second 
system apparatus ; 

the first system -apparatus p resenting information to the second system apparatus : 

the first system -apparatus inputting a determination from the second system 
apparatus that the client has a valid session credential with the second syste mapparatus : 

the first system -apparatus effecting successful authentication so as to grant 
access, to the protected resource on the first syste mapparatus . to the client, based on the 
determination from the second system- apparatus that the client has a valid session credential 
with the second syste mapparatus ; 

the first system -apparatus inputting information from the second 
systemapparatus, and in response, the first system -apparatus outputting. to the second 
systemapparatus, a determination that the first system -apparatus h as a valid session credential 
for the client at the first syste mapparatus ; and 
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the second system -apparatus effecting successful authentication so as to grant access, to 
the further protected resource on the second system apparatus , to the client based on the 
determination from the first system apparatus that the client has a valid session credential with 
the first s y s tem appar atu s . 

24. (Canceled) 

25. (Currently Amended) The method of claim 23, wherein the protected resource in 
the first system- apparatus includes content provided on a pay-per-use basis, and wherein the 
protected resource in the second s yste m apparatus includes content provided on a pay-per-use 
basis. 

26. (Currently Amended) The method of claim 23, wherein the protected resource in 
the first system -apparatus includes content provided on a subscription basis, and wherein the 
protected resource in the second system-a pparatus includes content provided on a subscription 
basis. 

27. (Currently Amended) A method for validating credentials comprising: 
inputting, at a first syst e m apparatus that grants session credentials based on 

successful authentication, a request from a client to access a protected resource on the first 

system apparatus , the protected resource on the first system -apparatus being accessible by the 

client only after successful authentication of the client at the first system-apparatus; 

determining, at the first system -apparatus whether a client have a valid session 
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credential granted by the first syste mapparatus ; 

retrieving, at the first s ystem apparatus , information from a session token held by 
the client if the client does not have a valid session credential granted by the first 
system ap paratus . wherein the information is retrieved from the client and the information 
corresponds to a session credential for a second syste mapparatus . the second system apparatus 
(1) grants session credentials based on successful authentication at the second system apparatus . 
and (2) includes a protected resource on the second system apparatus that is accessible by the 
client; the protected resource on the second system apparatus being accessible by the client only 
after successful authentication of the client at the second syst e m apparatus ; 

transmitting, at the first sy s tem apparatus , at least some of the information from 
the session token to the second syste mapparatus : 

receiving and inputting, at the first syst e m apparatus . information associated with 
a determination from the second system- apparatus whether the client has a valid session 
credential with the second system apparatus , wherein the client's session credential with the 
second system -apparatus is periodically renewed via the first system apparatus ; 

effecting, at the first syste mapparatus , successful authentication to the client so 
as to grant access, to the protected resource on the first syst e m apparatus , to the client based on 
the information associated with the determination from the second system ' apparatus that the 
client has a valid session credential with the second syste mapparatus ; and 

directing the client to the first system -apparatus to establish a session credential, 
after the determination from the second system- apparatus that the client does not have a valid 
session credential granted by the second syste mapparatus . 
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28. (Currently Amended) A method for validating credentials comprising: 

inputting, at a first syst e m apparatus that grants session credentials based on 
successful authentication, a request from a client to access a protected resource on the first 
system apparatus , the protected resource on the first system- apparatus being accessible by the 
client only after successful authentication of the client at the first system apparatus : 

determining, at the first system -apparatus whether a client have a valid session 
credential granted by the first syste mapparatus ; 

retrieving, at the first system apparatus , information from a first session token 
held by the client if the client does not have a valid session credential granted by the first 
.syst e m apparatus , wherein the information is retrieved from the client and the information 
corresponds to a session credential for a second syste mapparatus , the second system apparatus 
(1) grants session credentials based on successful authentication at the second system apparatus . 
and (2) includes a protected resource on the second system -apparatus that is accessible by the 
client; the protected resource on the second system- apparatus being accessible by the client only 
after successful authentication of the client at the second systema pparatus ; 

transmitting, at the first syste mapparatus , at least some of the information from 
the first session token to the second system apparatus ; 

receiving and inputting, at the first systema pparatus . information associated with 
a determination from the second system apparatus whether the client has a valid session 
credential with the second syste mapparatus . wherein the client's session credential with the 
second system apparatus is periodically renewed via the first s y ste mapparatus ; 

effecting, at the first systema pparatus . successful authentication to the client so 

as to grant access, to the protected resource on the first syste mapparatus , to the client based on 
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the information associated with the determination from the second syst e m apparatus that the 
client has a valid session credential with the second system apparatus ; and 

directing the client to the first system-a pparatus to establish a session credential, 
after the determination from the second system -apparatus that the client does not have a valid 
session credential granted by the second syste mapparatus . wherein the step of directing the 
client to the first system- apparatus to establish a session credential further comprises: 

receiving, at the first system apparatus , a redirect code in response to the 
determination from the second system -apparatus that the client does not have a valid session 
credential granted by the second systef ftapparatus ; 

directing the client to a log in page provided by the second system 
apparatus based on the redirect code; 

receiving, at the first system- apparatus from the client, log in information; 

sending, from the first system -apparatus to the second system apparatus , 
the log in information; and 

receiving, at the client, a second session token if the second system 
apparatus determines that the log in information is valid. 

29. (Currently Amended) A method for validating credentials comprising: 

inputting, at a First syst e m apparatus that grants session credentials based on 

successful authentication, a request from a client to access a protected resource on the first 

system apparatus , the protected resource on the first system- apparatus being accessible by the 

client only after successful authentication of the client at the first system apparatus ; 

determining, at the first system -apparatus whether a client have a valid session 
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credential granted by the first system apparatus ; 

generating a log in page at the first system apparatus and present the log in page 
to the client, wherein the log in page corresponds to a second syste mapparatus , the second 
system- apparatus (1) grants session credentials based on successful authentication at the second 
sy st em -apparatus , wherein the session credentials of the second sy s t e m - apparatus is periodically 
renewed via the first syste m apparatus , and (2) includes a protected resource on the second 
system -apparatus that is accessible by the client; the protected resource on the second s ys t e m 
apparatus_bcing accessible by the client only after successful authentication of the client at the 
second syst e nr. apparatus : 

receiving, at the first system- apparatus from the client, authentication credentials 
required by the log in page; 

transmitting, from the first system apparatus to the second system apparatus . the 
authentication credentials required by the log in page; and 

generating, at the first syst e m apparatus , one or more session tokens for the first 
system- apparatus and the second system a pparatus if the second system apparatus determines 
that the authentication credential required by the log in page is valid, wherein the one or more 
session tokens for the first system- apparatus and the second system -apparatus g rant access, to 
the protected resource on the first system -apparatus and to the protected resource on the second 
system -apparatus . 
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